Timely controls commensurate with risk and asset life-cycle

frameworkAPRA CPS 234 Information Security sectionImplementation of controls csf 2.0ID.RA-03 ID.RA-04 ID.RA-05 ID.RA-06 PR.DS-01 PR.DS-02 PR.DS-10 topicsRisk Assessment, Data Protection frameworks0 11 1

Official textAn APRA-regulated entity must have information security controls to protect its information assets, including those managed by related parties and third parties, that are implemented in a timely manner and that are commensurate with:
(a) vulnerabilities and threats to the information assets;
(b) the criticality and sensitivity of the information assets;
(c) the stage at which the information assets are within their life-cycle; and
(d) the potential consequences of an information security incident.APRA Prudential Standard CPS 234 Information Security. Based on content from the Federal Register of Legislation at 27 October 2026 (footnote markers removed and lines reflowed). For the latest information on Australian Government legislation please go to https://www.legislation.gov.au. Licensed under CC BY 4.0: https://creativecommons.org/licenses/by/4.0/

gap from CPS 234 → gap to CPS 234 →

Wrong or missing mapping? Report it

Equivalents of Para 21 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.RA-03 ID.RA-04 ID.RA-05 ID.RA-06 PR.DS-01 PR.DS-02 PR.DS-10	Internal and external threats to the organization are identified and recorded; Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded…	Editorial	Same topic: Risk Assessment, Data Protection (editorial pick)
ISO 27001	A.5.14 A.8.10 A.8.11 Clause 6.1.2 Clause 6.1.3	Information transfer; Information deletion…	Editorial	Same topic: Data Protection, Risk Assessment (editorial pick) 34 loosely related (not mappings) A.5.3 Segregation of duties Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.7 Threat intelligence Loosely related Only shares CSF ID.RA-03, ID.RA-05, ID.RA-06: related, not a mapping A.5.10 Acceptable use of information and other associated assets Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.13 Labelling of information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.15 Access control Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.1 Screening Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.2 Terms and conditions of employment Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.5 Responsibilities after termination or change of employment Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 26 more in the downloads
CIS v8.1	CIS 3.1 CIS 3.4 CIS 3.5 CIS 3.11 CIS 3.12	Establish and Maintain a Data Management Process; Enforce Data Retention…	Editorial	Same topic: Data Protection (editorial pick) 9 loosely related (not mappings) CIS 3.13 Deploy a Data Loss Prevention Solution Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 3.6 Encrypt Data on End-User Devices Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CIS 3.9 Encrypt Data on Removable Media Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CIS 3.10 Encrypt Sensitive Data in Transit Loosely related Only shares CSF PR.DS-02: related, not a mapping CIS 9.1 Ensure Use of Only Fully Supported Browsers and Email Clients Loosely related Only shares CSF PR.DS-02: related, not a mapping CIS 9.4 Restrict Unnecessary or Unauthorized Browser and Email Client Extensions Loosely related Only shares CSF PR.DS-02: related, not a mapping CIS 9.5 Implement DMARC Loosely related Only shares CSF PR.DS-02: related, not a mapping CIS 9.6 Block Unnecessary File Types Loosely related Only shares CSF PR.DS-02: related, not a mapping …and 1 more in the downloads
SOC 2	C1.2 CC3.2 CC3.3 CC3.4 CC6.5	Disposing of confidential information; Risk identification and analysis…	Editorial	Same topic: Data Protection, Risk Assessment (editorial pick) 3 loosely related (not mappings) CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Loosely related Only shares CSF PR.DS-02: related, not a mapping
PCI DSS	3.2.1 3.3.1 3.4.1 12.3.1	Account data storage minimised, with retention and disposal; Sensitive authentication data not kept after authorisation…	Editorial	Same topic: Data Protection, Risk Assessment (editorial pick) 25 loosely related (not mappings) 3.4.2 PAN copying prevented over remote-access technologies Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping 3.7.1 Key management: strong key generation Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping 3.7.4 Key management: key changes at end of cryptoperiod Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping 4.2.1.1 Inventory of trusted keys and certificates kept Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping 6.3.3 Security patches installed promptly Loosely related Only shares CSF ID.RA-05, ID.RA-06: related, not a mapping 2.3.1 Wireless vendor defaults changed Loosely related Only shares CSF PR.DS-02: related, not a mapping 3.5.1 PAN rendered unreadable wherever stored Loosely related Only shares CSF PR.DS-01: related, not a mapping 3.5.1.3 Disk encryption access managed separately from OS access Loosely related Only shares CSF PR.DS-01: related, not a mapping …and 17 more in the downloads
CMMC	MP.L2-3.8.3 RA.L2-3.11.1 SC.L2-3.13.16	Media Disposal; Risk Assessments…	Editorial	Same topic: Data Protection, Risk Assessment (editorial pick) 25 loosely related (not mappings) SC.L2-3.13.1 Boundary Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.4 Shared Resource Control Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.5 Public-Access System Separation Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.6 Network Communication by Exception Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.11 CUI Encryption Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI.L2-3.14.2 Malicious Code Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI.L2-3.14.4 Update Malicious Code Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 17 more in the downloads
800-53	RA-3 RA-7 SC-8 SC-28 SI-7	Risk Assessment; Risk Response…	Editorial	Same topic: Risk Assessment, Data Protection (editorial pick) 37 loosely related (not mappings) CA-3 Information Exchange Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-4 Information in Shared System Resources Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-7 Boundary Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-7(10) Prevent Exfiltration Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-13 Cryptographic Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC-43 Usage Restrictions Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI-3 Malicious Code Protection Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI-4 System Monitoring Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 29 more in the downloads
HIPAA	§164.308(a)(1)(ii)(A)§164.310(d)(2)(i)§164.312(c)	Risk Analysis; Disposal…	Editorial	Same topic: Risk Assessment, Data Protection (editorial pick) 26 loosely related (not mappings) §164.308(a)(1)(ii)(B) Risk Management Loosely related Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(a)(4)(ii)(A) Isolating Health care Clearinghouse Function Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.312(a)(2)(iv) Encryption and Decryption Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.312(c)(2) Mechanism to Authenticate Electronic Protected Health Information Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.312(e)(2)(i) Integrity Controls Loosely related Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 18 more in the downloads
GDPR	Art.5(1)(e)Art.5(1)(f)Art.32(1)(b)Art.35(1)Art.35(7)	Principles relating to processing of personal data; Principles relating to processing of personal data…	Editorial	Same topic: Data Protection, Risk Assessment (editorial pick) 2 loosely related (not mappings) Art.32(1)(a) Security of processing Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.34(3)(a) Communication of a personal data breach to the data subject Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping
NIS2	2.1 12.2 12.3	Risk management framework; Handling of assets…	Editorial	Same topic: Risk Assessment, Data Protection (editorial pick) 2 loosely related (not mappings) 6.10 Vulnerability handling and disclosure Loosely related Only shares CSF ID.RA-04, ID.RA-05, ID.RA-06: related, not a mapping 9.1 Cryptography Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping
Essential Eight	ISM-1488	Microsoft Office macros in files originating from the internet are blocked	Loosely related	No mapping. Only shares CSF PR.DS-02: related, not a mapping
DORA	Art.8(2)Art.8(3)Art.8(7)Art.9(2)Art.9(3)(c)Art.9(3)(d)	Identification; Identification…	Editorial	Same topic: Risk Assessment, Data Protection (editorial pick) 4 loosely related (not mappings) Art.9(3)(a) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.9(4)(d) Protection and prevention Loosely related Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.13(1) Learning and evolving Loosely related Only shares CSF ID.RA-03: related, not a mapping Art.45(1) Information-sharing arrangements on cyber threat information and intelligence Loosely related Only shares CSF ID.RA-03: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.